【MOD安全防护】惊爆！黑客病毒突袭模拟人生圈！快检查你的电脑是否安全！1.105可用

祁言言言

感谢分享！

RENE7770

WARNING: extremely malicious malware found in mods!
警告：模组中发现极其恶意的恶意软件！

Recently some mods were uploaded to different pages (MTS, TSR, Curseforge and LoversLab), which contain malicious malware code in the script file. The script files are modifidied to download and run an unknown exe file silently without the user knowing.
最近，一些模组被上传到不同的页面（MTS、TSR、Curseforge 和 LoversLab），其中脚本文件中包含恶意软件代码。脚本文件被修改为在用户不知情的情况下静默下载并运行未知的 exe 文件。

Here are the mods we know for sure were affected by the recent malware outbreak:
以下是我们确定受到最近恶意软件爆发影响的模组：

• “Cult Mod v2” uploaded to ModTheSims by PimpMySims (impostor account)
  “Cult Mod v2”由 PimpMySims 上传至 ModTheSims（冒名顶替者帐户）
• “Social Events – Unlimited Time” uploaded to CurseForge by MySims4 (single-use account)
  “社交活动 – 无限时间”由 MySims4 上传到 CurseForge（单用帐户）
• “Weather and Forecast Cheat Menu” uploaded to The Sims Resource by MSQSIMS (hacked, real account)
  “天气和预报作弊菜单”由 MSQSIMS 上传到模拟人生资源（已被黑客入侵，真实账户）
• “Seasons Cheats Menu” uploaded to The Sims Resource by MSQSIMS (hacked, real account)
  “Seasons Cheats Menu”由 MSQSIMS 上传至 The Sims Resource（已被黑客入侵，真实账户）
• “Motherlode Menu” by MSQSIMS (hacked, real account)
  MSQSIMS 的“Motherlode Menu”（被黑，真实账户）
• “Mood Cheat Menu” by MSQSIMS (hacked, real account)
  MSQSIMS 的“Mood Cheat Menu”（被黑，真实账户）
• “Mouth Preset N16” by PlayersWonderland (hacked, real account)
  PlayersWonderland 的“Mouth Preset N16”（被黑，真实账户）
• “Cult Sex Mod V1” from LoversLab
  LoversLab 的“Cult Sex Mod V1”
  
  

Please note that none of these modders mentioned above are responsible for the malware. Please do not send them harassing messages.
请注意，上述这些修改者均不对恶意软件负责。请不要向他们发送骚扰信息。

If you believe you downloaded or updated any of these mods in the last two or three weeks, take the proper safety measures now!
如果您认为您在过去两三周内下载或更新了任何这些模组，请立即采取适当的安全措施！

Due to this malware using an exe file, we believe that anyone using a Mac or Linux device is completely unaffected by this.
由于该恶意软件使用 exe 文件，我们相信任何使用 Mac 或 Linux 设备的人都完全不会受到此影响。

If the exe file was downloaded and executed on your Windows device, it has likely stolen a vast amount of your data and saved passwords from your operating system, your internet browser (Chrome, Edge, Opera, Firefox, and more all affected), Discord, Steam, Telegram, and certain crypto wallets. Thank you to anadius for decompiling the exe.
如果该 exe 文件是在您的 Windows 设备上下载并执行的，它可能会窃取您的操作系统、互联网浏览器（Chrome、Edge、Opera、Firefox 等均受影响）、Discord 中的大量数据并保存密码、Steam、Telegram 和某些加密钱包。感谢anadius反编译exe。

To quickly check if you have been compromised, press Windows + R on your keyboard to open the Run window. Enter “%AppData%/Microsoft/Internet Explorer/UserData” in the prompt and hit OK. This will open up the folder the malware was using. If there is a file in this folder called “Updater.exe”, you have unfortunately fallen victim to the malware. We are unware at this time if the malware has any function which would delete the file at a later time to cover its tracks.
要快速检查您是否已受到威胁，请按键盘上的 Windows + R 打开“运行”窗口。在提示中输入“%AppData%/Microsoft/Internet Explorer/UserData”，然后单击“确定”。这将打开恶意软件正在使用的文件夹。如果此文件夹中有一个名为“Updater.exe”的文件，那么您很不幸已成为该恶意软件的受害者。目前我们不知道该恶意软件是否具有稍后删除该文件以掩盖其踪迹的功能。

To quickly remove the malware from your computer, Overwolf has put together a cleaner program to deal with it. This program should work even if you downloaded the malware outside of CurseForge. [color=var(--color-content-link)]Download “SimsVirusCleaner.exe” from their github page linked here and run it. Once it has finished, it will give you an output about whether any files have been removed.
为了快速从您的计算机中删除恶意软件，Overwolf 编写了一个更干净的程序来处理它。即使您在 CurseForge 之外下载了恶意软件，该程序也应该可以运行。从此处链接的 github 页面下载“SimsVirusCleaner.exe”并运行它。完成后，它将向您提供有关是否有任何文件已被删除的输出。

If you think you may have been affected by any of these mods, it is vitally important that you change your passwords for all your important accounts as soon as possible. If your credit card information was stored on your computer or in any of your accounts linked to your passwords, you may need to contact your bank or credit card company to inform them your card number is not secure.
如果您认为自己可能受到这些模组的影响，那么尽快更改所有重要帐户的密码至关重要。如果您的信用卡信息存储在您的计算机上或与您的密码关联的任何帐户中，您可能需要联系您的银行或信用卡公司，告知他们您的卡号不安全。

Further investigations suggest that the malware tries to infect Discord and crypto wallet programs, and simply removing the malicious exe file may not be enough. If they are infected, running Discord or the crypto wallet will attempt to reapply the malware to your device. If you were affected by the compromised mods, you should also uninstall Discord and any crypto wallet programs and then, once you are sure the malware is gone, re-install them from a fresh download to clear out any remnants of the malware.
进一步调查表明，该恶意软件试图感染 Discord 和加密钱包程序，仅仅删除恶意 exe 文件可能还不够。如果它们被感染，运行 Discord 或加密钱包将尝试将恶意软件重新应用到您的设备。如果您受到受损模组的影响，您还应该卸载 Discord 和任何加密钱包程序，然后，一旦您确定恶意软件已消失，请从新下载的内容重新安装它们，以清除恶意软件的任何残留物。

We’d also like to remind everyone to enable Two-Factor Authentication (2FA) to add an extra layer of security even if your password is stolen. Many software programs and web-based accounts support some kind of 2FA these days; for Discord, you can start the set up process in your user settings under the “My Account” tab. For a detailed guide, check out the Discord official website [color=var(--color-content-link)]here.
我们还想提醒大家启用双因素身份验证 (2FA)，以增加额外的安全层，即使您的密码被盗也是如此。如今，许多软件程序和基于网络的帐户都支持某种 2FA；对于 Discord，您可以在“我的帐户”选项卡下的用户设置中开始设置过程。如需详细指南，请访问此处的 Discord 官方网站。

RENE7770

如果有下载过下方mod的请自行排查，截图自该帖mod作者网页。

952587121

感谢分享好可怕

manasama

突然有一种说不出话来的感觉……谢谢楼主。

飞翔的地图

感谢楼主分享